feat(ec2): instance-networks introspection endpoint + SDKs + docs (#1745 phase 5)

[vieiralucas]

Summary

Phase 5 (final) of EC2 real network isolation (#1745). Stacked on #1757 (phase 4); base retargets as the stack merges.

Adds a debugging surface for "why can't X reach Y" and documents the whole #1745 networking story everywhere.

• Server: GET /_fakecloud/ec2/instance-networks returns, per instance, the Docker/Podman network or k8s NetworkPolicy backing it, its container IP, the isolationBackend (docker/podman/kubernetes/none), the securityGroupEnforcement mechanism (nftables/networkpolicy/disabled), and whether enforcement is enforcementActive vs degraded. Backed by a new Ec2Runtime::network_isolation_summary.
• SDKs: get_instance_networks / getInstanceNetworks added to all six (Rust/Go/Python/TS/Java/PHP) with the Ec2InstanceNetwork(s) types.
• Docs: introspection.md gains an EC2 section (both endpoints); ec2.md gains a Network isolation section (default VPC, per-subnet L3, nftables SG enforcement, k8s NetworkPolicy, compose interop, the NET_ADMIN requirement) and its now-stale "security groups not enforced" limitation is corrected; README + llms.txt + llms-full.txt updated; every SDK README + SDK doc page gains an EC2 section documenting both introspection methods.

Test plan

• crates/fakecloud-e2e/tests/sdk.rs::sdk_ec2_get_instance_networks — asserts the endpoint reports the resolved default VPC/subnet and a valid isolation-backend + enforcement mode (passes locally).
• cargo clippy -p fakecloud-ec2 -p fakecloud-sdk -p fakecloud --all-targets -- -D warnings, cargo fmt --all --check, bash scripts/check-doc-counts.sh all clean.
• Go SDK go build ./... + Python ast.parse clean; TS/PHP validated by their CI lint jobs.

---

Summary by cubic

Adds an EC2 instance-network introspection endpoint and SDK methods to help debug “why can’t X reach Y,” and documents real per-subnet isolation with optional security‑group/NACL enforcement. Final phase of #1745.

• New Features

  • Server: GET /_fakecloud/ec2/instance-networks returns per instance the backing network (Docker/Podman network or k8s NetworkPolicy), container IP, isolationBackend (docker/podman/kubernetes/none), securityGroupEnforcement (nftables/networkpolicy/disabled), and enforcementActive (active vs degraded).
  • SDKs: get_instance_networks / getInstanceNetworks added to Rust, Go, Python, TypeScript, Java, and PHP. New e2e asserts default VPC/subnet resolution and valid backend/enforcement. Minor SDK fixes included (Java import, Python formatting).

• Docs

  • Introspection docs: new EC2 section covering both endpoints.
  • EC2 docs: new “Network isolation” section (default VPC, per‑subnet L3 isolation, nftables SG/NACL enforcement, k8s NetworkPolicy, Compose interop, CAP_NET_ADMIN/nft requirement); removed the outdated “security groups not enforced” note. README and SDK docs updated.

^{Written for commit df23975. Summary will update on new commits.}

[codecov]

Codecov Report

❌ Patch coverage is 0% with 85 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/fakecloud-server/src/introspection.rs	0.00%	28 Missing ⚠️
crates/fakecloud-server/src/main.rs	0.00%	24 Missing ⚠️
crates/fakecloud-ec2/src/runtime/mod.rs	0.00%	18 Missing ⚠️
crates/fakecloud-sdk/src/client.rs	0.00%	12 Missing ⚠️
crates/fakecloud-ec2/src/runtime/k8s.rs	0.00%	3 Missing ⚠️

📢 Thoughts on this report? Let us know!